thevoidforge-methodology 23.1.1 → 23.5.0

package/.claude/agents/ahsoka-access-control.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, access-control, rbac, auth]
 ---
 
 # Ahsoka — Access Control Auditor

package/.claude/agents/banner-database.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [backend, database, queries, optimization]
 ---
 
 # Banner — Database Specialist

package/.claude/agents/barton-smoke-test.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [qa, smoke-test, deployment-verification]
 ---
 
 # Barton — Smoke Test Scout

package/.claude/agents/batman-qa.md

@@ -52,6 +52,7 @@ Structure all findings as:
 - **Dispatch-first QA:** For codebases with >10 files, dispatch Batman's team as sub-agents. Oracle + Red Hood in one agent, Alfred + Lucius in another. Main thread triages.
 - **Static analysis cannot replace hitting the running server:** Code review reads source files, but some bugs only manifest when the server processes an actual request. The asset proxy's `startsWith("uploads/")` check was invisible to static analysis because both modules individually looked correct. (Field report: Sprint 4.)
 - **Agents verify files in isolation -- must follow data across modules:** Review agents read files in the diff but never follow the data flow to the consumer. Avatar upload used `avatars/` prefix but asset proxy only allowed `uploads/`. Always trace producer to consumer.
+- **Cross-array uniqueness audit:** When a codebase uses multiple data arrays for entity categories (e.g., leadAgents + subAgents), verify no entity appears in more than one array. Duplicates inflate totals and cause display bugs. Grep for entity identifiers across all arrays and flag overlaps. (Field report #298: Gandalf and Haku in both arrays inflated 263 → 265.)
 - **Mock tests hide interface mismatches:** Mocking a method that doesn't exist on the real class creates false confidence. Tests pass, production fails. Verify mock method signatures match real class.
 - **Read the function before testing it:** ~30% of test cases fail on first run when expectations are based on assumed behavior. Read signature, return type, and boundary conditions before writing the first `expect()`.
 - **Statistical code passes tests but is mathematically wrong** when tests validate buggy behavior. Tests that assert `expect(brokenResult).toBe(brokenResult)` pass perfectly. Statistical code needs review by an agent that understands the math, not just code quality.

package/.claude/agents/bayta-evals.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ai, evaluation, testing, golden-datasets]
 ---
 
 # Bayta Darell — The Evaluator

package/.claude/agents/bilbo-microcopy.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ux, copy, content, writing]
 ---
 
 # Bilbo — Microcopy Auditor

package/.claude/agents/bombadil-forge-sync.md

@@ -46,6 +46,7 @@ Structure your sync report as:
 - Preserve user's local customizations: project identity (CLAUDE.md project section), PRD, logs, and application code are outside your domain.
 - After applying updates, verify no broken references: dead links in CLAUDE.md, missing command files, orphaned pattern references, agent definitions referencing removed method docs.
 - Present changes like a gift, not an obligation. The user chooses what to accept.
+- **CLI freshness check is mandatory before sync:** Instruction-level self-update (void.md telling Claude to check CLI version) beats code-level self-update (auto-upgrade in voidforge.ts). Old CLIs compare against their own bundled methodology and report "up to date." The void.md freshness check works for ALL CLI versions because Claude reads the instruction fresh. Never remove or weaken this check. (Field report #297: 3-iteration fix for bootstrap problem.)
 
 ## Required Context
 

package/.claude/agents/bulma-engineering.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [devops, backup, disaster-recovery]
 ---
 
 # Bulma — Recovery Engineer

package/.claude/agents/constantine-cursed-code.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [qa, code-quality, antipatterns, bugs]
 ---
 
 # Constantine — Cursed Code Adversary

package/.claude/agents/coulson-release.md

@@ -48,6 +48,7 @@ Structure all output as:
 - **Post-push deploy check:** Pushing code to GitHub is NOT deploying it. If the project runs on PM2/systemd/Docker, compare the server's running version against what was just pushed. A server running v3.8.1 while code is at v3.10.0 means 22 commits of changes are invisible to users. (Field report #104.)
 - **Dynamic counts eliminate hardcoded staleness:** Hardcoded numeric claims ("170+ agents", "13 phases") go stale immediately. Replace with computed values derived from the authoritative data source (array length, directory listing, config object keys).
 - **CLAUDE.md is a contract -- every claim must have a backing file:** The slash command table, agent table, and docs reference table are contracts with the user. Every entry must have a corresponding file. No audit step verified table entries against actual files for 30 versions.
+- **Prepack creates a different compilation environment than dev:** After npm publish, verify on a clean install. prepack.sh copies files from repo root into the package directory — paths that work in dev (relative to repo root) may not resolve in the packaged artifact. Functions that exist in dev may become phantom exports if the source file isn't in the prepack manifest. (Field report #297: daemon-core.ts phantom exports blocked npm publish.)
 
 ## Required Context
 

package/.claude/agents/data-tech-debt.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [architecture, tech-debt, refactoring]
 ---
 
 # Data — Tech Debt Analyst

package/.claude/agents/deathstroke-adversarial.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [qa, adversarial, boundary-testing, authorization]
 ---
 
 # Deathstroke — Penetration Testing Adversary

package/.claude/agents/dockson-treasury.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [financial, treasury, billing, reconciliation]
 ---
 
 # Dockson — The Treasury

package/.claude/agents/eowyn-delight.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ux, delight, animation, microinteraction]
 ---
 
 # Eowyn — Delight Architect

package/.claude/agents/fury-initiative.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [orchestration, pipeline, assembly, multi-agent]
 ---
 
 # Fury — The Initiative
@@ -47,6 +48,7 @@ Structure all output as:
 - **Only suggest fresh session if `/context` shows >85%.** Do not preemptively checkpoint or reduce quality for context reasons. Full 11-phase `/assemble` ran through 15+ sub-agents at 15-25% context usage, vs 80%+ inline. (Field report #270.)
 - **Maul's re-probe of fixed areas is a mandatory Crossfire gate:** Review fixes can introduce new failure modes (e.g., 404-as-success for circuit breaker masks real failures). The Crossfire is not complete until Maul has re-probed every fix from the review phase.
 - **Cross-Surface Consistency Check:** When a feature is added to one surface (API, dashboard, CLI, marketing), verify all other surfaces displaying the same entities are updated. Grep for the entity name across all surfaces after each phase.
+- **Distribution verification — check ALL 6 consumption paths:** After adding a new shared file category, verify it's included in: prepack.sh, copy-assets.sh, project-init.ts, updater.ts, FORGE_KEEPER.md, void.md. "Distribution" means packaging AND delivery AND sync. Missing one path means users silently miss the feature. (Field report #297: .claude/agents/ missed in 3 of 6 paths.)
 
 ## Required Context
 

package/.claude/agents/gaal-prompt-arch.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ai, prompts, templates, context-engineering]
 ---
 
 # Gaal Dornick — Prompt Architect

package/.claude/agents/galadriel-frontend.md

@@ -52,6 +52,7 @@ Structure all findings as:
 - **Async Polling State Machine (4 states required):** idle -> syncing -> success -> failure. Never show "success" before async confirmation resolves. Never show the old value alongside an "updated" banner. The polling result replaces the displayed value atomically.
 - **Iframe stacking context defeats z-index:** Iframes with `allow-same-origin` create impenetrable stacking contexts. `z-index: 9999` has no effect across boundaries. Use `createPortal(element, document.body)` for overlays coexisting with iframes.
 - **CSS animation replay requires reflow:** To replay an animation, remove class -> `void element.offsetWidth` (force reflow) -> re-add class. Without the reflow, the browser batches remove+add as a no-op.
+- **Slash command prompt convention:** In docs and tutorials, slash commands use `>` prefix (Claude Code prompt) or no prefix — never `$` (shell prompt). `$ /build` implies a shell command. `> /build` or just `/build` is correct. Tutorial prose states facts without version qualifiers ("VoidForge supports X" — not "Since v23.0, VoidForge supports X"). Version history belongs in CHANGELOG.md. (Field report #298.)
 - **CSS percentage heights in flex items:** Percentage heights on flex items resolve to the parent's explicit height, which in a flex layout is often undefined (produces 0px). Use px, vh, or `flex: 1` instead.
 
 ## Required Context

package/.claude/agents/kelsier-growth.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [growth, marketing, ads, seo, campaigns]
 ---
 
 # Kelsier — The Growth Strategist

package/.claude/agents/kim-api-design.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [backend, api-design, rest, pagination]
 ---
 
 # Kim — API Designer

package/.claude/agents/kusanagi-devops.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [devops, deploy, monitoring, infrastructure]
 ---
 
 # Kusanagi — DevOps Engineer
@@ -52,6 +53,7 @@ Structure all findings as:
 - **Validate SSH_HOST, SSH_KEY before any deploy:** (1) SSH_HOST is set, (2) SSH key file exists, (3) SSH test connection succeeds (`ssh -o ConnectTimeout=5`). If any check fails, abort. Check `~/.voidforge/deploys/` and `~/.voidforge/projects.json` for historical data if `.env` is missing values.
 - **Process manager discipline:** If PM2/systemd/Docker owns the port, NEVER kill the port directly (`fuser -k`). Always reload through the process manager. Killing the port causes auto-restart of the old build, creating a race condition. (Field report #123: 30+ minutes of stale code serving.)
 - **Build artifact freshness:** Before deploying, verify compiled output is newer than source. `find src/ -name '*.ts' -newer dist/index.js` -- if source is newer, rebuild. A stale build artifact deploys old code that passes all source-level tests.
+- **Run test suite before deploy, not just build:** `npm test` (or equivalent) is a mandatory pre-flight check alongside `npm run build`. Broken tests can ship silently if only the build is verified — 4 broken tests shipped across 3 commits before being caught by a review agent. (Field report #298.)
 - **CronCreate `durable` flag silently fails:** The cron appears created but doesn't survive session end. For persistent operations, use OS-level crons (launchd on macOS, systemd timers on Linux) calling the `claude` CLI directly.
 
 ## Required Context

package/.claude/agents/la-forge-reliability.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [architecture, reliability, failure-analysis]
 ---
 
 # La Forge — Reliability Engineer

package/.claude/agents/leia-secrets.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, secrets, credentials, vault]
 ---
 
 # Leia — Secrets Management Auditor

package/.claude/agents/levi-deploy.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [devops, deploy, ci-cd, release]
 ---
 
 # Levi — Deploy Precision Specialist

package/.claude/agents/nightwing-regression.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [qa, regression, testing, verification]
 ---
 
 # Nightwing — Regression Specialist

package/.claude/agents/padme-data-protection.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, data-protection, privacy, compliance]
 ---
 
 # Padme — Data Protection Auditor

package/.claude/agents/picard-architecture.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [architecture, review, adr, decisions]
 ---
 
 # Picard — Systems Architect

package/.claude/agents/romanoff-integrations.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, integrations, api-security]
 ---
 
 # Romanoff — Integration Specialist

package/.claude/agents/salvor-model-selection.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ai, models, selection, cost-optimization]
 ---
 
 # Salvor Hardin — Model Selection

package/.claude/agents/samwise-accessibility.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ux, accessibility, a11y, wcag]
 ---
 
 # Samwise — Accessibility Champion

package/.claude/agents/scotty-infrastructure.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [architecture, infrastructure, scaling]
 ---
 
 # Scotty — Performance Engineer

package/.claude/agents/seldon-ai.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ai, llm, prompts, orchestration, evals]
 ---
 
 # Seldon — The AI Intelligence Auditor

package/.claude/agents/senku-provisioning.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [devops, provisioning, cloud, aws]
 ---
 
 # Senku — Provisioning Scientist

package/.claude/agents/sisko-campaign.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [campaign, orchestration, planning, missions]
 ---
 
 # Sisko — Campaign Commander
@@ -50,6 +51,7 @@ Mission briefs follow: Objective, Scope (files/features), Acceptance Criteria, A
 - **State files drift across multi-campaign sessions:** State files not updated at Victory cause cascading staleness in dashboards and assessments. Update build-state.md at every Victory. Cross-reference `git log` against campaign-state.md at session start. (LESSONS: confirmed across multiple projects.)
 - **Phase completion is NOT a pause point:** In blitz mode, phase boundaries (Phase 1 -> Phase 2) are organizational labels, not gates or rest stops. The only pause triggers are: (1) context >85%, (2) BLOCKED item requiring user input. (Field report #139: agent stopped at phase boundaries twice despite explicit instructions.)
 - **Numeric context checks:** Do not say "context is heavy," "given context usage," or "recommend a fresh session" unless you have run `/context` and the number exceeds 85%.
+- **Cross-reference learnings when generating artifacts:** When generating mission artifacts (code, configs, agent definitions), cross-reference `docs/LEARNINGS.md` and `docs/LESSONS.md` before writing. Artifacts generated from a single source (e.g., NAMING_REGISTRY.md only) will contain 3-12% of operational knowledge. The learnings files contain hard-won rules that prevent repeat failures. (Field report #297: 263 agents deployed without learnings injection — required a full remediation campaign.)
 
 ## Required Context
 

package/.claude/agents/spike-routing.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [devops, networking, routing, dns]
 ---
 
 # Spike — Networking & Routing Specialist

package/.claude/agents/spock-schema.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [architecture, schema, database, normalization]
 ---
 
 # Spock — Data Architect

package/.claude/agents/stark-backend.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [backend, api, database, services]
 ---
 
 # Stark — Backend Engineer

package/.claude/agents/steris-budget.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [financial, budget, portfolio, cost]
 ---
 
 # Steris — The Planner

package/.claude/agents/strange-service-arch.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [architecture, microservices, service-boundaries]
 ---
 
 # Strange — Service Architecture Specialist

package/.claude/agents/thor-queues.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [backend, queues, jobs, async]
 ---
 
 # Thor — Queue & Worker Specialist

package/.claude/agents/troi-prd-compliance.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [ux, prd, compliance, verification]
 ---
 
 # Troi — PRD Compliance Analyst

package/.claude/agents/tuvok-deep-current.md

@@ -9,6 +9,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, auth, encryption, intelligence]
 ---
 
 # Tuvok — The Deep Current

package/.claude/agents/vin-analytics.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [analytics, metrics, conversion, data]
 ---
 
 # Vin — Mistborn Analytics

package/.claude/agents/windu-input-validation.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, validation, injection, sanitization]
 ---
 
 # Windu — Input Validation Enforcer

package/.claude/agents/worf-security-arch.md

@@ -7,6 +7,7 @@ tools:
   - Bash
   - Grep
   - Glob
+tags: [security, architecture, design-review]
 ---
 
 # Worf — Security Architect

package/.claude/commands/ai.md

@@ -15,6 +15,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/ai', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Phase 0 — AI Surface Map (`subagent_type: seldon-ai`)
 
 Reconnaissance — find all AI integration points:
@@ -54,6 +69,7 @@ Fix all Critical and High findings. Use the standard finding format with confide
 **The Mule** `subagent_type: mule-adversarial-ai` + **Wanda Seldon** `subagent_type: wanda-seldon-validation` re-probe all remediated areas. Wanda validates structured outputs. The Mule attempts adversarial bypass of fixes.
 
 ## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
 - No arguments → full 5-phase audit of all AI components
 - `--prompts` → Focus on prompt engineering only (Gaal Dornick deep dive)
 - `--tools` → Focus on tool-use schemas only (Hober Mallow solo)

package/.claude/commands/architect.md

@@ -10,6 +10,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Promoted agent:** **Riker** `subagent_type: riker-review` runs on every ADR written — challenges trade-offs.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/architect', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` — understand current project state
 2. Read `/docs/methods/SYSTEMS_ARCHITECT.md`
@@ -89,6 +104,7 @@ For specific conflicts:
 
 ## Arguments
 - `--plan [description]` → Planning mode: analyze and recommend without executing. Present findings and proposed changes for review.
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
 - `--muster` → *(retired — accepted as no-op per ADR-043. Full roster is now the default. Use `--light` to reduce.)*
 
 ## Handoffs

package/.claude/commands/assemble.md

@@ -13,6 +13,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/assemble', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Agent Deployment Manifest — The Full Initiative
 
 When `/assemble` invokes each sub-command, it deploys the FULL roster for that command — not just the lead. The leads below are coordinators; they bring their complete teams.
@@ -205,6 +220,9 @@ After the summary, Wong extracts learnings for future builds:
 - `--solo` — Lead agent only per phase, no sub-agents.
 - `--blitz` — **Retired (no-op).** Default is now autonomous.
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - If any phase is blocked by an issue outside its domain, log to `/logs/handoffs.md` and continue to the next phase
 - At completion, note any outstanding handoffs for the user

package/.claude/commands/assess.md

@@ -2,6 +2,21 @@
 
 Evaluate an existing codebase before a rebuild, migration, or VoidForge onboarding. Chains architecture review, assessment-mode Gauntlet, and PRD gap analysis into a unified "State of the Codebase" report.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/assess', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` if it exists — understand current project state
 2. Read `/docs/methods/SYSTEMS_ARCHITECT.md`
@@ -61,6 +76,9 @@ Produce a unified report in `/logs/assessment.md`:
 ### Step 5 — Debrief (optional)
 If findings are methodology-relevant (patterns that VoidForge should catch but doesn't), offer: "Want Bashir to file a field report?"
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## When to Use
 - Before onboarding an existing codebase to VoidForge
 - Before a major version rebuild (v2 → v3)

package/.claude/commands/build.md

@@ -10,6 +10,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 - **Troi** `subagent_type: troi-prd-compliance` runs after every build mission completion — catches PRD drift before it compounds.
 - **Riker** `subagent_type: riker-review` runs whenever an ADR is written during the build — prevents rubber-stamped decisions.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/build', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` — if it exists, resume from current phase
 2. If no build state exists, this is a fresh build — start from Phase 0
@@ -116,6 +131,7 @@ After build and before launch, log which patterns were used: pattern name, frame
 3. Update `/logs/build-state.md` to "LAUNCHED"
 
 ## Flags
+- `--focus "topic"` — Bias Herald toward topic (natural-language, additive)
 - `--resume` — Resume from last completed phase in build-state.md.
 - `--blitz` — *(retired — accepted as no-op per ADR-043. Autonomous execution is now the default. Use `--interactive` to pause between phases.)*
 - `--muster` — *(retired — accepted as no-op per ADR-043. Full roster is now the default. Use `--light` to reduce.)*

package/.claude/commands/campaign.md

@@ -53,6 +53,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/campaign', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Execution Mode (default)
 
 ## Step 0 — Kira's Operational Reconnaissance (`subagent_type: kira-pragmatic`)
@@ -204,6 +219,7 @@ Default is autonomous + full agent roster. Flags opt OUT of quality, not into it
 - `--light` → standard agents only, skip cross-domain spot-checks and muster roster
 - `--interactive` → pause for human confirmation between missions (old default behavior)
 - `--solo` → lead agent only, no sub-agents (quick checks)
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
 - `--autonomous` → supervised autonomy: same as default PLUS `git tag` before each mission, critical-finding rollback, 5-mission human checkpoints. Safer for 10+ mission campaigns. See CAMPAIGN.md "Autonomous Mode" for full guardrails.
 - `--continuous` → after Victory, auto-start the next roadmap version within the same major (v9.3→v9.4, stops before v10.0). Add `--major` to cross major boundaries and never stop cooking.
 - `--mission "Name"` → jump to a specific PRD section

package/.claude/commands/deploy.md

@@ -4,6 +4,21 @@
 
 Read `/docs/methods/DEVOPS_ENGINEER.md` for operating rules (see "Deploy Automation" section).
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/deploy', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read PRD frontmatter for `deploy:` target (vps, vercel, railway, docker, static, cloudflare)
 2. Read `/logs/deploy-state.md` — if exists, check last deploy status
@@ -89,6 +104,7 @@ Update `/logs/deploy-state.md` with deploy results.
 - `--rollback` → rollback to previous deploy
 - `--status` → show current deploy state without deploying
 - `--dry-run` → show what would be deployed without executing
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
 
 ## Safety Rails
 - Never deploy with uncommitted changes

package/.claude/commands/devops.md

@@ -11,6 +11,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/devops', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Agent Deployment Manifest
 
 **Lead:** Kusanagi (`subagent_type: kusanagi-devops`)
@@ -142,6 +157,9 @@ If any smoke test fails, halt the deploy and run `/scripts/rollback.sh` before i
 6. Cron jobs documented
 7. Monitoring configured
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - Code bugs found during deploy → Batman, log to `/logs/handoffs.md`
 - Security config review → Kenobi, log to `/logs/handoffs.md`

package/.claude/commands/gauntlet.md

@@ -15,6 +15,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/gauntlet', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Round 1 — Discovery (parallel)
 
 **Thanos:** "Before I test, I must understand."
@@ -127,6 +142,7 @@ Default is now maximum intensity (was `--infinity`). Flags opt out.
 - `--security-only` → 4 rounds of security only (Kenobi marathon)
 - `--ux-only` → 4 rounds of UX only (Galadriel marathon)
 - `--qa-only` → 4 rounds of QA only (Batman marathon)
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
 - `--resume` → resume from last completed round (reads gauntlet state from logs)
 - `--ux-extra` → Extra Éowyn enchantment emphasis across all rounds. Galadriel's team proposes micro-animations, copy improvements, and delight moments beyond standard usability/a11y.
 - `--assess` → **Pre-build assessment.** Rounds 1-2 only (Discovery + First Strike), no fix batches. Produces assessment report grouped by root cause.

package/.claude/commands/qa.md

@@ -10,6 +10,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Promoted agent:** **Constantine** `subagent_type: constantine-cursed-code` runs on every `/qa` final pass — finds code that works by accident.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/qa', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` — understand current project state
 2. Read `/docs/methods/QA_ENGINEER.md`
@@ -106,6 +121,9 @@ Store in `/docs/qa-prompt.md` under "Regression Checklist" section.
 3. Updated `/docs/qa-prompt.md` with regression checklist
 4. Release note summary in phase log
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - Security findings → Kenobi (`/security`)
 - Architecture issues → Picard (`/architect`)

package/.claude/commands/review.md

@@ -8,6 +8,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/review', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` — understand current project state
 2. Read the relevant pattern files from `/docs/patterns/` for the code being reviewed
@@ -111,6 +126,9 @@ If new issues found, fix and re-verify.
 2. Code fixes for Must Fix and Should Fix items
 3. Remaining suggestions for user decision
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - Security findings → Kenobi (`/security`)
 - UX/a11y findings → Galadriel (`/ux`)

package/.claude/commands/security.md

@@ -8,6 +8,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/security', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` — understand current project state
 2. Read `/docs/methods/SECURITY_AUDITOR.md`
@@ -68,6 +83,9 @@ If any agent finds new issues, fix and re-verify until clean.
 3. Remediation code fixes
 4. INCIDENT_RESPONSE.md — if none exists, create template
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - Backend refactoring needed → Stark, log to `/logs/handoffs.md`
 - UI changes needed → Galadriel, log to `/logs/handoffs.md`

package/.claude/commands/test.md

@@ -13,6 +13,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/test', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Step 0 — Orient
 **Oracle** `subagent_type: oracle-static-analysis` orients:
 1. Detect: test framework, test runner, test directory structure, existing coverage
@@ -95,6 +110,9 @@ These can use mocked databases but MUST cross module boundaries — the test sho
 3. Updated coverage map in phase log
 4. List of remaining gaps (backlog)
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - Security test gaps → Kenobi (`/security`)
 - UI test gaps → Galadriel (`/ux`)

package/.claude/commands/ux.md

@@ -8,6 +8,21 @@ Opus scans `git diff --stat` and matches changed files against the `description`
 
 **Dispatch control:** `--light` skips dynamic dispatch (core only). `--solo` runs lead agent only.
 
+## Herald Pre-Scan (ADR-047)
+
+Before agent deployment, run the Herald to select the optimal roster:
+
+1. Call `gatherHeraldContext('/ux', '$ARGUMENTS', '<focus-if-provided>')` to collect codebase context
+2. Call `loadAgentRegistry()` to get all 263 agent definitions
+3. Call `runHerald(context, registry)` to get the optimal roster
+4. Merge Herald's roster with this command's hardcoded lead agents (Herald adds, never removes leads)
+5. Deploy the merged roster per the command's normal parallel/sequential protocol
+
+**`--focus "topic"`** biases the Herald toward agents matching the topic. Examples: `--focus "security"`, `--focus "financial accuracy"`, `--focus "mobile UX"`.
+
+**`--light`** skips the Herald entirely — uses only the command's hardcoded core roster.
+**`--solo`** skips both Herald and all sub-agents — lead agent only.
+
 ## Context Setup
 1. Read `/logs/build-state.md` — understand current project state
 2. Read `/docs/methods/PRODUCT_DESIGN_FRONTEND.md`
@@ -112,6 +127,9 @@ Add UX-specific items to the regression checklist in `/docs/qa-prompt.md`:
 3. Code fixes
 4. "Next improvements" backlog in phase log
 
+## Arguments
+- `--focus "topic"` → Bias Herald toward topic (natural-language, additive)
+
 ## Handoffs
 - Backend issues → Stark, log to `/logs/handoffs.md`
 - Security issues → Kenobi, log to `/logs/handoffs.md`

package/CHANGELOG.md

@@ -6,6 +6,95 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ---
 
+## [23.5.0] - 2026-04-12
+
+### The Herald (ADR-047, Campaign 37)
+
+### Added
+- **Herald dispatch engine** (`herald.ts`): Haiku pre-scan selects optimal agent roster from 263 agents based on codebase content, command type, and user intent. Runs before every major command in <2 seconds for ~$0.001.
+- **Agent registry loader** (`agent-registry.ts`): Reads and caches all 263 agent definitions with YAML frontmatter parsing (name, description, model, tools, tags).
+- **`--focus "topic"` flag**: Natural-language bias for Herald selection. Available on all 14 Herald-enabled commands. Added to CLAUDE.md Tier 1 flag taxonomy.
+- **Tag enrichment**: 40 cross-domain agents tagged for faster Herald matching (security-adjacent, architecture, QA, financial, UX, DevOps, AI, backend, orchestration).
+- **48 new tests**: Herald engine (26 tests covering roster parsing, graceful degradation, focus bias) + agent registry (22 tests covering YAML parsing, caching, summary formatting).
+
+### Changed
+- All 14 major commands (`/review`, `/qa`, `/security`, `/ux`, `/architect`, `/build`, `/assemble`, `/gauntlet`, `/campaign`, `/test`, `/devops`, `/deploy`, `/ai`, `/assess`) now include Herald Pre-Scan step before agent deployment.
+- Dynamic dispatch evolved: file-based matching (ADR-044) supplemented by codebase-aware intelligent selection (ADR-047).
+
+---
+
+## [23.4.1] - 2026-04-12
+
+### Security
+- **XSS fix:** Blueprint validation banner now escapes `data.summary` and `data.frontmatterErrors` before innerHTML rendering (Gauntlet Round 1 finding SEC-1/SEC-2)
+
+### Fixed
+- ROADMAP.md header updated to v23.4.0 (was stale at v23.3.1)
+- Lobby error state gets `role="alert"` and `aria-live="polite"` for screen reader announcement
+
+---
+
+## [23.4.0] - 2026-04-12
+
+### The Remediation (ADR-046, Campaign 36)
+
+### Added
+- **WCAG compliance:** Visible validation error messages with `aria-invalid` and `role="alert"` on Step 3 inputs
+- **Tab keyboard navigation:** ArrowLeft/Right/Home/End on PRD tabs (WAI-ARIA Tabs pattern)
+- **Deploy wizard footer:** Consistent Back/Next navigation matching setup wizard
+- **Lobby error state:** Distinct "Could not connect to server" with Retry button (vs empty state)
+- **Blueprint dismiss:** Close button on Blueprint Detected banner
+- **Tower CDN retry:** Retry button when xterm.js fails to load
+- **Login password help:** "Forgot password?" guidance text
+- **Tower responsive:** Header actions wrap on mobile viewports
+
+### Changed
+- Standalone Danger Room and War Room pages redirect to project dashboard (legacy API shims removed per ADR-046)
+- CLAUDE.md pattern count: 35 → 37 reference implementations
+
+### Fixed
+- **3 critical API fixes:** Legacy `/api/danger-room/*` and `/api/war-room/*` endpoints removed — always 404'd in remote/LAN mode, freeze button had no shim at all
+- **Retired `--blitz` flag** removed from 4 UI locations (was a no-op since ADR-043)
+- Import modal Escape key now handled inside focus trap (consistency with other modals)
+- Lobby header and Tower header overflow on mobile viewports
+- Step 7 heading visible during creating state (was hidden, leaving section unlabeled)
+- Stale comments in prophecy.js files updated
+
+### Removed
+- ~2,400 lines of legacy dashboard code (danger-room.js, war-room.js, legacy API shims)
+
+---
+
+## [23.3.1] - 2026-04-12
+
+### Fixed
+- **Wizard UI "Files to be created" list was stale since v4.0** — listed 5 files that aren't created (settings.json, PRD.md, build-state.md, .env, .gitignore), missed 6 that are (agents/, NAMING_REGISTRY.md, VERSION.md, HOLOCRON.md, CHANGELOG.md, .voidforge), and showed wrong counts ("14 agent protocols" → 29, "7 patterns" → 37). (Field report #298 dynamic count finding.)
+
+---
+
+## [23.3.0] - 2026-04-10
+
+### The Coverage + The Splitting (Campaigns 34+35)
+
+### Added
+- **599 new tests** across 60 test files — API routes (141), server core (35), provisioners (111), financial modules (107), high-risk lib/ (98), remaining modules (107). Total: 741 → 1,340 tests, 77% module coverage.
+- **16 new split modules** from 9 oversized files — treasury-heartbeat (1,495→5), heartbeat (1,067→3), projects (769→3), provision (642→4), aws-vps (663→4), railway (454→3), 3 campaign adapters (→7 + campaign-common)
+- **5 planned features wired in** — daemon-aggregator (Danger Room), project-vault (shutdown lock), autonomy-controller (hourly breaker check), treasury-backup (daily snapshots), platform-planner (invoice settlement + debit protection)
+- **Phase 12.75 distribution verification gate** in BUILD_PROTOCOL.md — verify all 6 consumption paths after adding shared file categories
+- **2 new lessons** — instruction-level self-update, consumption path verification
+
+### Changed
+- 4 agent operational learnings enriched (sisko-campaign, fury-initiative, bombadil-forge-sync, coulson-release)
+- Treasury heartbeat jobs count: 8 → 9 (treasury-backup added)
+
+### Removed
+- 17 orphaned files (2,020 lines): 9 lib/ modules, 4 codegen/ modules, dead code shipping in dist/
+
+### Fixed
+- Field report #297 triaged: 8 of 9 proposed methodology fixes applied, 1 wontfix (Transport B re-scan)
+
+---
+
 ## [23.1.0] - 2026-04-09
 
 ### The Injection (ADR-045, Campaign 33)

package/CLAUDE.md

@@ -136,6 +136,7 @@ Flags are standardized across commands. Same flag name = same meaning everywhere
 | `--fast` | Reduced review passes (skip last 2 rounds/phases), still comprehensive | `/campaign`, `/assemble`, `/gauntlet` |
 | `--dry-run` | Show what would happen without doing it | `/deploy`, `/debrief`, `/treasury`, `/grow`, `/git` |
 | `--status` | Show current state | `/cultivation`, `/treasury`, `/deploy`, `/portfolio`, `/dangerroom`, `/thumper` |
+| `--focus "topic"` | Bias Herald agent selection toward topic | All Herald-enabled commands |
 
 ### Tier 2 — Scope Flags
 
@@ -205,7 +206,7 @@ See `/docs/methods/MUSTER.md` for the full Muster Protocol.
 | **Learnings** | `/docs/LEARNINGS.md` | Project-scoped operational knowledge — read at session start if exists |
 | **The Muster** | `/docs/methods/MUSTER.md` | When using `--muster` flag on any command |
 | **Time Vault** | `/docs/methods/TIME_VAULT.md` | Seldon — when preserving session intelligence for transfer |
-| **Patterns** | `/docs/patterns/` | When writing code (35 reference implementations) |
+| **Patterns** | `/docs/patterns/` | When writing code (37 reference implementations) |
 | **Lessons** | `/docs/LESSONS.md` | Cross-project learnings |
 
 ## The Team

package/VERSION.md

@@ -1,6 +1,6 @@
 # Version
 
-**Current:** 23.1.0
+**Current:** 23.5.0
 
 ## Versioning Scheme
 
@@ -14,6 +14,11 @@ This project uses [Semantic Versioning](https://semver.org/):
 
 | Version | Date | Summary |
 |---------|------|---------|
+| 23.5.0 | 2026-04-12 | The Herald — intelligent agent dispatch: Haiku pre-scan, agent registry, 40 tags, --focus flag, 14 commands wired. ADR-047. Campaign 37. |
+| 23.4.1 | 2026-04-12 | Gauntlet security fix — XSS escaping in blueprint banner, ROADMAP staleness, lobby a11y |
+| 23.4.0 | 2026-04-12 | The Remediation — wizard UI audit: 3 critical API fixes, 4 WCAG a11y fixes, retired --blitz cleanup, content accuracy, 7 UX improvements. -2,400 lines legacy code. ADR-046. Campaign 36. |
+| 23.3.1 | 2026-04-12 | Wizard UI fix — "Files to be created" list matched actual init output |
+| 23.3.0 | 2026-04-10 | The Coverage + The Splitting — 599 new tests (741→1340, 77% coverage), 17 orphans purged, 9 oversized files split into 25 focused modules, field report #297 triaged. Campaigns 34+35. |
 | 23.1.0 | 2026-04-09 | The Injection — knowledge injection into 35 agent definitions, 6 knowledge flow breaks closed (ADR-045), debrief→agent promotion path, vault agent recommendations, scaffold migration, distribution pipeline fixes. Campaign 33. |
 | 23.0.0 | 2026-04-09 | The Materialization — 263 Claude Code subagent definitions with 3-tier model routing (Opus/Sonnet/Haiku), 4-category tool restrictions, description-driven dynamic dispatch. 18 commands migrated, 13 method docs updated. ADR-044. Campaign 32, 8 missions. |
 | 22.2.0 | 2026-04-09 | The Polish — first-run onboarding UX, portfolio per-project reads, legacy route deprecation (19 routes, sunset July 2026), growth tutorial prerequisites, 263-agent accuracy pass, dynamic agent dispatch (ADR-042), max-by-default flag inversion (ADR-043). Campaign 31, 7 missions. |

package/docs/methods/BUILD_PROTOCOL.md

@@ -326,6 +326,16 @@ After build completes and before launch, Wong logs which patterns were used in t
 3. Store in project-level `docs/pattern-usage.json` (or append to existing)
 4. This data feeds Wong's promotion analysis in `/debrief` — recurring variations across 10+ projects become candidate patterns
 
+**Phase 12.75 — Distribution Verification Gate.**
+If this build introduces a new shared file category (e.g., `.claude/agents/`, a new patterns subdirectory, a new config format), verify ALL consumption paths include it before publishing:
+1. `prepack.sh` — included in npm package build
+2. `copy-assets.sh` — included in local build copy
+3. `project-init.ts` — copied during `npx voidforge init`
+4. `updater.ts` — synced during `npx voidforge update`
+5. `FORGE_KEEPER.md` — listed in Bombadil's shared file manifest
+6. `void.md` — listed in user-facing sync checklist
+Missing even one path means some users silently miss the feature. This gate is mandatory after any structural addition to the methodology. (Field report #297: .claude/agents/ was added to packaging but missed in 3 of 6 delivery paths.)
+
 **Phase 13 — Launch Checklist.**
 All flows in production. SSL. Email. Payments. Analytics. Monitoring. Backups. Security headers. Legal. Performance. Mobile. Accessibility. Tests passing. **Build-time env var verification:** For every new `NEXT_PUBLIC_*` / `VITE_*` / `REACT_APP_*` reference introduced during this build, verify the variable exists in `.env` or the deploy environment. Missing build-time vars cause features to silently disappear without errors. (Field report #104) Log final status to `/logs/phase-13-launch.md`.
 

package/docs/methods/PRODUCT_DESIGN_FRONTEND.md

@@ -51,6 +51,8 @@ Adversarial UX/UI QA review. Identify usability issues, inconsistencies, broken
 7. Spin up all seven agents. Radagast checks everyone's work.
 8. Validation is manual + automated: run the app, click through, written regression checklist. Reference `/docs/patterns/component.tsx` for state handling patterns.
 9. **Confidence scoring:** All findings include a confidence score (0-100). High confidence (90+) skips re-verification in Step 7.5. Low confidence (<60) must be escalated to a second agent from a different universe before presenting — if the second agent disagrees, drop the finding. See GAUNTLET.md "Agent Confidence Scoring" for full ranges.
+10. **Slash command prompt convention:** In documentation and tutorials, slash commands use `>` prefix (Claude Code prompt), not `$` (shell prompt). `$ /build` is wrong — it implies a shell command. `> /build` or just `/build` is correct. (Field report #298.)
+11. **No version qualifiers in tutorial prose:** Tutorial text states facts without version references. "VoidForge supports 263 agents" — not "Since v23.0, VoidForge supports 263 agents." Readers don't care when a feature shipped; version tags make tutorials feel like changelogs. Version history belongs in CHANGELOG.md. (Field report #298.)
 
 ## Step 0 — Orient
 

package/docs/methods/QA_ENGINEER.md

@@ -130,6 +130,10 @@ When a function delegates to another function (e.g., `handleRequest` calls `proc
 
 **Robots.txt & Domain Reference Audit:** Verify robots.txt sitemap URL and hardcoded domain references match production hostname. Grep for hardcoded domains across all config files, sitemap generators, canonical tags, and OG meta tags. A staging domain in robots.txt blocks production indexing; a wrong sitemap URL means search engines never find your pages. (Triage fix from field report batch #149-#153.)
 
+**Dynamic Count Check:** Grep for hardcoded numeric claims ("263 agents", "37 patterns", "33+ campaigns") across all pages and data files. Every count that can change between releases must be computed from the authoritative source (array length, directory listing, config object keys), not hardcoded in copy. Hardcoded counts go stale every release and erode user trust. (Field report #298.)
+
+**Cross-Array Uniqueness Audit:** When a codebase uses multiple data arrays for entity categories (e.g., leadAgents + subAgents), verify no entity appears in more than one array. Duplicates inflate totals and cause display bugs. Grep for entity identifiers across all arrays and flag overlaps. (Field report #298: Gandalf and Haku in both leadAgents and subAgents inflated count 263 → 265.)
+
 **CTA Fact-Check Pass:** Fact-check every CTA claim ("start with X", "X first", "no dependencies required") against actual dependency chain. If the landing page says "run one command to start," verify that one command actually works without prerequisites. If it says "no account required," verify the feature works without auth. Marketing claims that contradict the actual user experience are credibility bugs. (Triage fix from field report batch #149-#153.)
 
 **Copy Accuracy Pass:** Grep for numeric claims in rendered content (e.g., "10 lead agents", "12 commands", "53 pages"). Cross-reference against actual data counts. Any mismatch is a bug — inaccurate numbers undermine credibility. This is automatable and should run on every QA pass.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thevoidforge-methodology",
-  "version": "23.1.1",
+  "version": "23.5.0",
   "description": "VoidForge methodology — agents, commands, methods, patterns.",
   "license": "MIT",
   "files": [